CVE-2026-66768

SAP GUI for Java (CWE-807) fails to correctly enforce its trust level policy when certain functions are invoked from a connected backend system, meaning the client relies on untrusted backend input when making security decisions. To exploit it, an attacker needs low-privileged access to a connected backend (for example, a compromised or malicious SAP backend) and must manipulate that backend to trigger the affected functionality, which also requires interaction from the logged-in user (CVSS UI:R). Successful exploitation yields arbitrary command execution on the victim's workstation, with the changed-scope vector (S:C) allowing a backend-level foothold to break out onto the end-user machine and seriously impacting its confidentiality, integrity, and availability. Anyone running SAP GUI for Java to connect to SAP backends is exposed, particularly in scenarios where less-trusted or low-privileged users can influence the backend their colleagues connect to. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so no in-the-wild exploitation is currently known; a fix shipped as part of SAP's September 2026 security patch day.

What to do: Deploy the SAP GUI for Java patch released with SAP's September 2026 security updates, checking the SAP advisory for the exact affected and fixed versions for your release line. Inventory endpoints running SAP GUI for Java (especially macOS/Linux desktops) and the backends they connect to, prioritizing users who connect to backends accessible to low-privileged or external users. As an interim mitigation, restrict low-privileged accounts' ability to invoke the affected backend functions and treat backend compromise as a path to client workstation takeover when assessing risk.